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SUBJECT:  Report  on  Quality  Control  Review  of 

PricewaterhouseCoopers,  LLP,  for  0MB  Circular  A-133  Audit  Report  of 
Institute  for  Defense  Analyses,  Fiscal  Year  Ended  September  25,  1998 
Report  No.  D-2000-6-008  (Project  No.  D2000-OA-0123) 

We  are  providing  the  report  for  information  and  use.  The  Institute  for  Defense 
Analyses  engaged  the  PricewaterhouseCoopers,  LLP,  McLean,  Virginia,  to  perform  the  audit 
that  is  required  by  the  Office  of  Management  and  Budget  Circular  A-133  (the  Circular), 

“Audits  of  States,  Local  Governments,  and  Non-Profit  Organizations,”  dated  June  24,  1997 
(also  referred  to  as  “the  single  audit”).  The  Institute  for  Defense  Analyses  is  a  non-profit 
corporation  that  operates  as  a  federally  funded  research  and  development  center  based  in 
Alexandria,  Virginia.  For  the  fiscal  year  ended  September  25,  1998,  the  Institute  for  Defense 
Analyses  reported  total  Federal  expenditures  of  $109,951,862  for  two  DoD  contracts. 

Background.  On  December  4,  1998,  PricewaterhouseCoopers,  LLP,  (PwC)  issued  their 
single  audit  report  containing  unqualified  opinions  on  the  financial  statements,  the  Schedule  of 
Expenditures  of  Federal  Awards,  and  the  compliance  with  requirements  applicable  to  the 
Federal  contracts  at  the  Institute  for  Defense  Analyses  (IDA).  In  addition,  PwC  provided 
reports  on  internal  control  over  financial  reporting  and  over  compliance  and  prepared  a 
Schedule  of  Findings  and  Questioned  Costs  that  summarizes  the  results  of  the  single  audit. 

The  Defense  Contract  Audit  Agency  (DC  A  A),  Alexandria,  Virginia,  also  submitted  a  report 
dated  October  1,  1999,  as  required  by  the  Circular,  that  duplicated  PwC  reporting  on  internal 
control  over  compliance;  related  opinions  on  compliance  of  major  contracts  with  laws, 
regulations  and  the  contract  provisions  and  the  Schedule  of  Expenditures  of  Federal  Awards; 
and  a  Schedule  of  Findings  and  Questioned  Costs.  In  contrast  to  PwC,  DCAA  described 
internal  control  weaknesses  that  they  considered  reportable  but  not  material  and  one  instance  of 
noncompliance  with  the  Allowable  Costs/Cost  Principles  requirement 

Quality  Control  Review  Objective.  As  the  cognizant  agency  for  IDA,  the  Office  of  Inspector 
General,  DoD,  performed  a  quality  control  review  of  the  Office  of  Management  and  Budget 
(0MB)  Circular  A-133  Single  Audit  of  IDA  for  the  fiscal  year  ended  September  25,  1998 
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The  objective  of  our  review  was  to  determine  whether  the  FY  1998  report  that  IDA  submitted 
to  the  Single  Audit  Clearinghouse  met  the  applicable  reporting  standards  and  whether  PwC 
conducted  the  audit  as  required  by  applicable  standards  and  the  Circular.  See  Appendix  A  for 
a  discussion  of  the  scope,  prior  quality  control  reviews  related  to  PwC,  and  single  audit 
requirements. 

Review  Results.  PwC  complied  with  the  Circular  in  performing  the  audit  of  the  financial 
statements  and  reporting  on  compliance  and  on  internal  control  over  financial  reporting. 
However,  PwC  did  not  meet  the  requirements  of  the  Circular  that  related  to  the  review  of 
compliance  with  requirements  and  internal  control  over  compliance  because  the  FY  1998  single 
audit  was  not  adequately  planned,  executed,  and  documented  (see  finding  A).  Moreover,  IDA 
did  not  properly  coordinate  the  single  audit  between  the  DCAA  and  PwC,  whose 
organizations,  in  turn,  did  not  take  appropriate  steps  to  consider  each  other’s  work  to  achieve  a 
proper  review  of  all  matters  (see  finding  B). 

Finding  A.  Performance  of  Fiscal  Year  1998  Single  Audit.  As  required  by  the  Circular, 
PwC  provided  a  complete  reporting  package  that  IDA  submitted  to  the  Single  Audit 
Clearinghouse.  In  addition,  PwC  adequately  performed  the  audit  of  the  financial  statements. 
However,  PwC  did  not  adequately  plan  the  audit  of  internal  control  over  compliance  with 
requirements;  therefore,  the  testing  of  the  internal  control  and  compliance  requirements  were 
improperly  executed.  The  inadequacies  occurred,  in  part,  because  PwC  used  an  outdated  audit 
program.  Also,  documentation  was  limited  or  non-existent  for  the  audit  as  a  whole.  PwC  did 
not  consider  the  risk  associated  with  using  computer  imagery  at  IDA  for  record  retention. 
Because  the  compliance  audit  was  not  performed  according  to  the  Circular,  the  costs  incurred 
by  IDA  for  the  single  audit  services  are  unallowable. 

Review  of  Internal  Control  Over  Compliance.  PwC  did  not  adequately  plan  the 
review  of  internal  control  for  the  one  major  program  at  IDA,  research  and  development.  The 
Circular,  generally  accepted  government  auditing  standards  (GAGAS),  and  the  American 
Institute  of  Certified  Public  Accountants  (AICPA)  guidance  on  generally  accepted  auditing 
standards  require  that  the  audit  be  properly  planned  to  identify  and  test  the  internal  control  for 
each  major  program.  The  auditors  must  first  identify  which  of  the  14  compliance  requirements 
can  be  applied  to  the  major  program  at  IDA.  Then  the  audit  working  papers  should  indicate  a 
sufficient  understanding  of  internal  control  over  Federal  programs  by  evaluating  how  the  five 
elements  of  internal  control-control  environment,  risk  assessment,  control  activities, 
information  and  communication,  and  monitoring— related  to  each  applicable  compliance 
requirement.  The  auditors  should  use  the  understanding  of  the  internal  control  they 
documented  to  (1)  identify  types  of  potential  noncompliance,  (2)  consider  factors  affecting  the 
risk  of  material  noncompliance,  and  (3)  design  compliance  tests. 

PwC  failed  to  adequately  test  internal  control  and  plan  the  compliance  review 
because  they  did  not  properly  identify  the  applicable  14  compliance  requirements  and  assess 
the  related  internal  control.  The  following  table  shows  which  of  the  14  compliance 
requirements  PwC  determined  to  be  applicable  and  the  testing  of  internal  control  as  reflected  in 
the  PwC  working  papers. 
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Determination  of  Applicability  of  Compliance  Requirements  by  PwC 

Determined  to  be  Internal  Control 
Compliance  Requirement _  Applicable  by  PwC*  Tested  by  PwC 


A. 

Activities  Allowed  or  Unallowed 

X 

B. 

Allowable  Costs/Cost  Principles 

X 

C. 

Cash  Management 

N/A 

D. 

Davis-Bacon  Act 

N/A 

E. 

Eligibility  of  Federal  Funds 

N/A 

F. 

Equipment  and  Real  Property  Management 

X 

G. 

Matching,  Level  of  Effort,  Earmarking 

N/A 

H. 

Period  of  Availability  of  Federal  Funds 

X 

I. 

Procurement  and  Suspension  and  Debarment 

X 

J. 

Program  Income 

N/A 

K. 

Real  Property  Acquisition/Relocation  Assistance 

N/A 

L. 

Reporting 

X 

M. 

Subrecipient  Monitoring 

N/A 

N. 

Special  Tests  and  Provisions 

*  The  PwC  working  papers  showed  that  the  compliance  requirement  was  applicable 
("X")  or  not  applicable  ("N/A")  to  the  research  and  development  program,  and,  in 
one  case,  was  not  considered  as  to  its  applicability  at  IDA. 


The  PwC  working  papers  do  not  indicate  how  the  auditors  determined  which  of 
the  14  compliance  requirements  were  applicable  and  to  what  extent  they  were  applicable  to 
IDA.  PwC  determined  that  7  of  the  14  compliance  requirements  were  not  applicable  to  IDA. 
However,  Item  G,  “Matching,  Level  of  Effort,  Earmarking,”  is  applicable.  PwC  did  not 
obtain  sufficient  evidence  to  know  whether  the  item  applied  to  IDA.  IDA  has  contracts  with 
level-of-effort  requirements.  PwC  indicated  that  they  had  reviewed  abstracts  or  briefs  of  the 
original  contracts.  However,  in  the  working  papers,  PwC  did  not  refer  to  nor  include  copies 
of  the  contracts,  abstracts,  or  contract  briefs  to  support  their  consideration  of  the  compliance 
requirement. 


For  the  six  compliance  requirements  that  PwC  determined  to  be  applicable,  the 
working  papers  do  not  show  the  assessment  of  internal  control  for  each  applicable  compliance 
requirement.  PwC  tested  the  internal  control  for  only  one  of  the  compliance  requirements. 

For  Item  I,  “Procurement  and  Suspension  and  Debarment,”  PwC  documented  that  IDA  had 
written  policies  and  procedures  and  selected  the  item  as  the  only  area  for  testing  the  operation 
of  internal  control  over  compliance.  We  attempted  to  re-test  the  original  five  vouchers  selected 
by  PwC  for  mathematical  accuracy,  approval,  and  allowability.  We  could  find  only  three 
vouchers,  which  were  all  for  travel  and  not  procurements.  The  working  papers  show  no 
criteria  to  measure  for  allowability,  and  no  value,  descriptions  of  transactions,  conclusions  or 
results  of  testing.  According  to  the  working  papers,  the  vouchers  were  tested  for  an  internal 
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control  feature  of  “approval,”  and  although  one  of  the  three  travel  vouchers  did  not  have  the 
proper  signature  for  approval,  it  was  still  paid.  To  add  to  the  deficiency  of  the  test,  PwC  did 
not  review  the  major  element  of  Compliance  Requirement  Item  I  that  ensures  that  purchases  of 
goods  or  services  are  not  procured  from  any  debarred  or  suspended  entity. 

For  Item  L,  “Reporting,”  PwC  working  papers  identified  one  report  required  of 
IDA--Standard  Form  1034,  a  public  voucher  (an  IDA  payment  vehicle).  PwC  did  not  address 
the  internal  control  that  would  identify  the  accounting  or  performance  records  to  support  the 
payments.  In  a  subsequent  step  of  the  audit,  PwC  addressed  additional  contract  reports  that 
were  not  considered  in  the  assessment  of  internal  control  over  the  compliance  for  “Reporting. 
For  Item  N,  “Special  Tests  and  Provisions,”  the  PwC  working  papers  do  not  show  any 
assessment  of  this  compliance  requirement. 

For  the  assessment  of  all  compliance  requirements,  PwC  failed  to  consider  four 
DCAA  audit  reports,  in  which  each  addressed  a  major  component  of  the  IDA  accounting 
system  including  the  control  environment  and  overall  accounting  system  controls,  labor 
accounting  system,  billing  system,  and  the  accounting  system  for  indirect  and  other  direct 
costs.  Each  report  concluded  that  the  system  is  inadequate,  in  part,  based  on  the  lack  of 
written  policies  and  procedures.  PwC  did  not  document  any  reference  to  these  internal  control 
weaknesses  in  their  assessment  or  resolve  the  DCAA  consideration  of  these  deficiencies  as  a 
“reportable  condition,”  as  defined  by  the  AICPA. 

The  auditors  used  an  audit  program  that  was  developed  before  the  0MB 
Circular  A-133,  dated  June  24,  1997,  was  revised.  The  audit  program  was  not  designed  to 
review  the  five  elements  of  internal  control  for  each  compliance  requirement  of  the  AICPA 
Statement  of  Position  98-3,  “Audits  of  States,  Local  Governments  and  Not-for-Profit 
Organizations  Receiving  Federal  Awards.”  The  working  papers  had  no  evidence  of  the 
assessment  of  internal  control  over  the  applicable  compliance  requirements  for  the  audit  steps 
in  their  audit  program.  The  deficient  review  of  internal  control  over  compliance  does  not 
provide  a  sound  basis  for  the  compliance  review  of  the  two  multi-year,  multi-million  dollar 
contracts  representing  the  FY  1998  Federal  expenditures  of  $109,951,862. 

Audit  Execution  and  Documentation.  The  PwC  working  papers  do  not  demonstrate 
the  review  and  tests  of  internal  control  and  compliance  requirements  to  support  the  opinion  on 
compliance.  GAGAS  require  that  the  form  and  content  of  the  working  papers  should  allow  an 
experienced  auditor  to  understand  the  auditor’s  significant  conclusions  and  judgments.  In 
general,  the  working  papers  should  document  the  objectives,  scope,  and  methodology, 
including  the  sampling  criteria  the  auditors  used.  Specifically,  working  papers  should  include 
enough  information  about  the  work  performed  and  the  documents  (transactions  and  records) 
examined  so  that  an  experienced  auditor  would  be  able  to  examine  the  same  documents, 
perform  the  same  analyses,  and  come  to  the  same  conclusions.  PwC  reviewed  costs  for  the  2 
major  contracts  at  IDA  by  testing  15  transactions  from  each  contract.  The  working  papers  do 
not  show  the  type  of  cost  element,  its  amount,  date/time  period,  or  what  specific  criteria  were 
used  to  determine  the  allowability  of  any  transaction.  We  reviewed  additional  information 
from  PwC  to  re-test  a  sample  of  the  transactions,  but  the  spreadsheet  provided  no  additional 
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clarification  of  the  testing  conducted  by  PwC.  The  inadequate  explanations  in  the  working 
papers  provide  no  audit  trail  and  no  reasonable  assurance  that  IDA  materially  complied  with 
the  compliance  requirements. 

Compliance  testing  includes  the  examination  of  transactions  and  other  auditing 
procedures  that  provide  the  auditors  with  sufficient  evidence  to  support  an  opinion  on 
compliance,  required  by  Part  3  of  the  A- 133  Compliance  Supplement.  The  PwC  working 
papers  do  not  show  what  was  tested  and  how  the  test  was  conducted.  A  PwC  working  paper 
that  tests  Compliance  Requirement  Item  L,  “Reporting”  explains  that  three  different  types  of 
reports  “appear  to  have  been  forwarded  to  the  appropriate  contracting  officer.  ”  The  same 
working  paper  does  not  refer  to  the  public  voucher  that  PwC  identified  as  the  only  report  to 
support  the  applicability  of  Item  L  (refer  to  the  previous  discussion  in  the  “Review  of  Internal 
Control  Over  Compliance”  subparagraph).  Throughout  the  working  papers,  PwC  consistently 
referred  to  the  contracts  as  “grants”  and  did  not  refer  to  the  specified  cost  principles  of  the 
Federal  Acquisition  Regulation  as  a  criteria  for  measuring  compliance  for  the  federally  funded 
research  and  development  center,  even  when  reviewing  Compliance  Requirement  Item  B, 
“Allowable  Costs/Cost  Principles.  ”  Their  permanent  files  contained  one  copied  portion  of  the 
Federal  Acquisition  Regulation  that  referenced  section  31.205-18,  “Independent  research  and 
development  and  bid  and  proposal  costs.”  PwC  did  not  demonstrate  in  their  working  papers 
that  their  audit  steps  had  been  thorough  and  conclusive. 

Audit  Coverage  of  Computer  Imagery  for  Retention  of  Records.  PwC  informed  us 
that  they  reviewed  electronic  images  of  the  vouchers  from  the  contractor’s  electronic  record 
scanning  system  in  all  transaction  testing.  They  had  not  assessed  the  system  for  reliable 
input/output  and  maintenance  of  original  documentation  according  to  the  Federal  Acquisition 
Regulation  4.703,  “Policy  [for  Contractor  Records  Retention].”  Therefore,  without  an 
assessment  of  the  computer-generated  documentation,  PwC  should  have  reviewed  original 
documentation.  The  hard  copy  documentation  would  have  been  available  during  their  review, 
since  they  conducted  their  fieldwork  immediately  following  the  end  of  the  fiscal  year,  and  the 
contractor  maintains  the  original  documentation  for  one  year  after  it  is  scanned. 

DCAA  had  reviewed  the  electronic  record  scarming  system  and  reported  in 
May  1997  that  it  was  inadequate,  in  part,  due  to  the  lack  of  written  policies  and  procedures. 
However,  DCAA  did  not  provide  the  audit  information  to  PwC.  Based  on  their  review, 

DCAA  indicated  that  they  would  need  to  continue  reviewing,  on  a  selective  basis,  the  hard 
copy  documentation  until  IDA  had  formally  submitted  their  policies  and  procedures.  The  audit 
organizations  need  to  verify  the  scanned  documents  to  the  original  records  to  ensure  integrity 
of  the  contractor’s  underlying  documentation. 

Auditor  Qualifications.  The  PwC  audit  program.  Step  28,  included  a 
cautionary  note  to  “ensure  that  all  members  of  the  engagement  have  met  the  minimum 
CPE  requirements  contained  in  the  Yellow  Book  and  document  this  fact  in  the  planning 
memorandum.”  The  working  papers  did  not  address  this  program  step  The  CPE 
requirements  under  Paragraph  3.6  in  GAGAS  include  at  least  80  hours  of  continuing 
education  and  training,  which  contributes  to  the  auditor's  professional  proficiency  every 


5 


2  years,  at  least  20  hours  of  which  should  be  completed  in  any  1  year  of  the  2-year 
period.  GAGAS  also  requires  auditors  responsible  for  auditing  under  these  standards  to 
complete  at  least  24  of  the  80  hours  of  continuing  education  and  training  in  subjects 
directly  related  to  the  government  environment  and  to  government  auditing.  In 
addition,  auditors  should  receive  training  that  is  specifically  related  to  any  audited  entity 
operating  in  a  unique  environment  such  as  IDA. 

Responsibility  of  IDA  for  PwC  Audit.  Our  review  of  the  PwC  FY  1998  single  audit 
concludes  that  the  audit  does  not  meet  the  requirements  of  0MB  Circular  A-133.  IDA  paid 
PwC  a  total  of  $79,573.29  to  perform  the  FY  1998  single  audit  by  IDA.  0MB  Circular  A-133 

§ _ .  230(b)(1)  does  not  allow  a  non-Federal  entity  to  charge  the  cost  of  any  audit  under  the 

Single  Audit  Act  Amendments  of  1996  that  was  not  conducted  according  to  the  Circular. 
Therefore,  any  costs  originally  incurred  for  audit  services  billed  by  PwC  for  the  FY  1998 
single  audit  must  be  accumulated  separately  as  unallowable  costs  and  must  not  be  charged  to 
Federal  awards  until  the  audit  is  corrected.  IDA  should  require  PwC  to  properly  perform  the 
audit  at  no  additional  cost  to  the  government. 

Summary.  The  auditors  did  not  adequately  plan,  execute,  and  document  the  compliance  part 
of  the  single  audit  according  to  the  0MB  Circular  A-133  requirements.  As  a  result,  there  is  no 
basis  to  rely  on  the  internal  control  to  plan  and  execute  the  compliance  tests.  Considering  the 
FY  1998  deficiencies,  IDA  needs  to  ensure  that  future  single  audits  meet  the  Circular 
requirements.  Federal  agencies  need  to  be  able  to  rely  on  the  audit  report  s  assurance  that 
internal  control  procedures  are  in  place  and  operating  effectively  for  the  major  programs  that 
are  identified  in  the  audit  report  and  that  there  is  a  reliable  basis  for  the  opinion  rendered  on 
the  compliance  for  IDA. 
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Recommendations,  and  Management  Comments 

A.l.  We  recommend  that  the  Treasurer,  Institute  for  Defense  Analyses: 

a.  Require  that  PricewaterhouseCoopers,  LLP,  redo  the  audit  of  the 
Institute  for  Defense  Analyses  for  its  fiscal  year  ended  September  25, 1998,  according  to 
the  Office  of  Management  and  Budget  Circular  A- 133  and  at  no  additional  cost  to  the 
Federal  Government. 

PwC  Comments.  The  PwC  management  concurred  for  IDA  who  agrees  with  the  comments 
provided  by  PwC.  The  management  comments  (see  page  15)  include  correction  plans  to 
withdraw  their  audits  to  redefine  the  scope  of  audit  and  revise  the  reporting  package  required 
by  the  0MB  Circular  A- 133  to  include  the  audit  work  of  DCAA. 

b.  Identify  as  unallowable  any  costs  associated  with  audit  services  that  were 
originally  provided  by  PricewaterhouseCoopers,  LLP,  to  report  on  the  Fiscal  Year  1998 
single  audit  until  the  audit  is  corrected  according  to  the  Office  of  Management  and 
Budget  Circular  A-133. 

PwC  Comments.  The  PwC  management  concurred  for  IDA  who  agrees  with  the  comments 
provided  by  PwC.  PwC  intends  to  credit  IDA  for  an  estimated  $17,000  of  their  original  fee 
for  the  subject  audit. 

c.  Ensure  that  deficiencies  identified  in  the  Fiscal  Year  1998  audit  are  not 
repeated  in  the  Fiscal  Year  1999  and  future  single  audits. 

PwC  Comments.  The  PwC  management  concurred  for  IDA  who  agrees  with  the  comments 
provided  by  PwC.  PwC  stated  that  they  plan  to  correct  the  Fiscal  Year  1999  single  audit  in  the 
same  manner  they  are  addressing  Fiscal  Year  1998  and  will  continue  the  same  approach  to  the 
single  audit  for  future  years. 

A.2.  We  recommend  that  PricewaterhouseCoopers,  LLP: 

a.  Document  in  the  working  papers  its  judgments,  procedures,  and  results 
or  conclusions  with  relevant  and  sufficient  evidence  for  all  audit  steps. 

b.  Revise  its  audit  program  for  the  single  audit  to  comply  with  the 
requirements  of  Office  of  Management  and  Budget  Circular  A-133  to  include  audit  steps 
that  document  an  understanding  of  the  5  internal  control  elements  related  to  each  of  the 
applicable  14  compliance  requirements. 

c.  Coordinate  and  document  their  audit  effort  with  Federal  auditors, 
throughout  the  conduct  of  the  single  audit  according  to  the  Office  of  Management  and 
Budget  Circular  A-133. 
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d.  Obtain  training  to  ensure  that  the  staff  assigned  to  the  Office  of 
Management  and  Budget  Circular  A-133  audits  is  properly  trained. 

e.  Adhere  to  its  audit  program  step  for  the  single  audit  that  requires 
continuing  professional  education  for  all  auditors  assigned  to  the  engagement  be 
documented  in  the  working  papers. 

PwC  Comments.  PwC  concurred  with  recommendations  A.2.a.  through  e  and  proposed 
acceptable  corrective  actions. 
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Finding  B.  Coordination  of  Single  Audit.  The  IDA  did  not  ensure  that  the  single  audit 
required  by  the  Circular  was  properly  coordinated  between  PwC  and  DCAA.  PwC  and  DC  A  A 
did  not  take  appropriate  steps  to  properly  review  all  matters  relating  to  the  single  audit. 

Procuring  Single  Audit  Services.  In  July  1998,  IDA  engaged  PwC  to  provide  all 
FY  1998  audit  services  required  to  meet  the  intent  of  the  Circular.  However,  DCAA 
maintains  an  on-site  suboffice  at  IDA  that  provided  an  annual  average  of  1600  hours  of 
contract  audit  services  from  FY  1996  through  1998.  The  contract  audit  services  supported 
DoD  procurement  and  contract  administration  activities  and  included  reviews  of  certified 
submissions  for  each  fiscal  year’s  incurred  costs  and  their  compliance  with  requirements 
identified  in  the  Circular.  In  March  1997,  after  a  meeting  with  PwC  and  IDA  concerning  the 
requirements  of  the  Circular,  DCAA  provided  PwC  (through  IDA)  with  an  audit  matrix 
showing  a  proposed  division  of  responsibility  between  DCAA  and  PwC  for  the  FY  1998  single 

audit.  Aside  from  the  requirements  of  the  0MB  Circular  A-133  § _ .305  “Auditor  selection,” 

IDA  did  not  consider  the  services  provided  by  the  DCAA  in  arranging  for  PwC  to  complete 
the  single  audit  as  shown  in  the  engagement  letter  dated  July  31,  1998.  In  order  to  achieve  a 
more  cost-effective  audit,  IDA  must  recognize  their  responsibility  in  coordinating  the  single 
audit  as  required  by  the  Circular. 

Relying  on  Work  Performed  by  Other  Auditors.  According  to  PwC,  except  for  the 
March  1997  meeting,  they  did  not  coordinate  with  or  contact  DCAA  before  or  during  the 
FY  1998  single  audit.  The  PwC  single  audit  report  does  not  mention  relying  on  DCAA,  nor 
does  it  recognize  their  audit  efforts.  However,  our  review  of  the  PwC  working  papers  shows 
that  during  their  review,  they  requested  and  IDA  provided  copies  of  four  separate  DCAA  audit 
reports,  in  which  each  addressed  a  major  system  including  the  control  environment  and  overall 
accounting  system  controls,  labor  accounting  system,  billing  system,  and  the  accounting  system 
for  indirect  and  other  direct  costs.  Each  audit  concluded  that  the  IDA  systems  were  inadequate 
in  part,  based  on  the  absence  of  written  policies  and  procedures  for  each  system.  The  PwC 
working  papers  had  no  evidence  as  to  how  they  addressed  the  system  deficiencies.  DCAA 
considered  the  system  deficiencies  a  reportable  condition  in  their  A-133  audit  as  addressed  by 
the  Circular.  DCAA  also  provided  their  annual  program  plan  and  a  list  of  audits  in  progress 
through  IDA  to  PwC.  Generally  accepted  auditing  standards  state  that  when  part  of  the  audit  is 
performed  by  other  auditors: 

The  principal  auditor  may  also  need  to  refer  to  the  programs  audited  by  other  auditors  in  his  or 
her  reports  on  the  schedule  of  expenditures  of  federal  awards,  compliance,  and  internal  control 
related  to  federal  awards,  as  they  relate  to  federal  awards  administered  by  the  component  unit 
In  such  cases,  the  auditor  should  follow  the  guidance  in  SAS  [Statement  on  Auditing  Standards] 

No.  1,  section  543  [“Part  of  Audit  Performed  by  Other  Independent  Auditors”] 

Clearly,  PwC  was  aware  of  DCAA,  their  audit  plans,  and  audit  reports.  The  0MB  Circular 

A-133  § _ .215  “Relation  to  other  audit  requirements”  requires  that  “(a)ny  additional  audits 

shall  be  planned  and  performed  in  such  a  way  as  to  build  upon  work  performed  by  other 
auditors  ”  PwC  should  be  coordinating  with  DCAA  to  achieve  a  complete  and  cost-effective 
review  of  the  Federal  awards. 
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If  IDA  had  obtained  a  coordinated  audit,  the  auditors  could  have  relied  on  the  work  of 
others  in  completing  the  audit.  In  order  to  achieve  a  more  cost-effective  audit,  IDA,  PwC,  and 
DCAA  must  all  recognize  their  individual  responsibilities  in  coordinating  the  single  audit. 

Recommendation  and  Management  Comment 

B.  We  recommend  that  the  Treasurer,  Institute  for  Defense  Analyses,  ensure  a 
coordinated  audit  among  the  procured  services  of  the  independent  public  accountant  and 
the  Defense  Contract  Audit  Agency  to  avoid  duplication,  and  to  achieve  a  complete  and 
cost  effective  audit. 

IDA  Response.  IDA  concurs.  IDA  did  not  provide  a  formal  written  response  but  their 
correction  plan  is  in  progress  as  evidenced  by  a  coordination  meeting  established  for  the 
FY  2000  single  audit  with  PwC,  DCAA,  and  the  OIG,  DoD. 


We  appreciate  the  courtesies  extended  during  the  review.  If  you  have  questions  on  this  report, 
please  contact  Mr.  Wayne  C.  Berry  at  (703)  604-8789  (wberry@dodig.osd.mil)  or  Ms.  Joanne 
Wallis  at  (703)  604-8748  (jwallis@dodig.osd.rail).  The  report  distribution  is  at  Appendix  B. 
The  audit  team  members  are  listed  inside  the  back  cover. 


Deputy  Assistant  Inspector  General 
for  Audit  Policy  and  Oversight 
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Appendix  A.  Quality  Control  Review  Process 

Scope  and  Methodology 


We  conducted  a  quality  control  review  of  the  PricewaterhouseCoopers,  LLP,  audit  of 
the  Institute  for  Defense  Analyses  (IDA)  for  the  fiscal  year  ended  September  25,  1998, 
and  the  resulting  reporting  submission  to  the  Single  Audit  Clearinghouse  dated 
March  1,  1999.  We  performed  our  review  using  the  1999  edition  of  the  “Uniform 
Quality  Control  Guide  for  the  A-133  Audits”  (hereafter  referred  to  as  “the  Guide”). 

The  Guide  applies  to  any  single  audit  that  is  subject  to  the  requirements  of  Office  of 
Management  and  Budget  (0MB)  Circular  A-133,  revised  June  24,  1997.  The  Guide  is 
the  approved  checklist  of  the  President’s  Council  on  Integrity  and  Efficiency  for 
performing  the  quality  control  review  procedures.  We  reviewed  the  audit  as  required 
by  the  OMB  A-133  Circular,  generally  accepted  government  auditing  standards  issued 
by  the  Comptroller  General  of  the  United  States,  and  generally  accepted  auditing 
standards  issued  by  the  American  Institute  of  Certified  Public  Accountants.  Our  review 
was  conducted  from  December  1999  through  June  2000  and  covered  areas  related  to  the 
financial  statements  and  the  one  major  program,  research  and  development.  As  the 
cognizant  audit  agency  for  IDA,  we  focused  our  review  on  the  following  qualitative 
aspects  of  the  single  audit: 

•  Qualifications  of  auditors 

•  Independence 

•  Due  professional  care 

•  Quality  control 

•  Planning  and  supervision 

•  Internal  control  and  compliance  testing 

•  Schedule  of  Expenditures  of  Federal  Awards 

•  Schedule  of  Findings  and  Questioned  Costs 

•  Data  Collection  Form 

Prior  Quality  Control  Reviews 

Since  January  1997,  we  have  performed  10  quality  control  reviews  of  Coopers  & 
Lybrand,  1  quality  control  review  of  Price  Waterhouse,  and  3  quality  control  reviews  of 
PricewaterhouseCoopers.  In  3  of  the  14  reports,  we  identified  4  deficiencies  resulting 
in  findings  and  made  recommendations.  In  addition,  3  of  the  14  reports  contained  7 
conditions  that  were  reported  and  suggestions  made  for  improvements. 
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Single  Audit  Requirements 

In  June  1997,  the  OMB  issued  Circular  A- 133,  “Audits  of  States,  Local  Governments, 
and  Non-Profit  Organizations.  ”  The  Circular  establishes  policies  to  guide 
implementation  of  the  Single  Audit  Act  1996  (Public  Law  98-502)  amendments  and 
provides  an  administrative  foundation  for  uniform  audit  requirements  for  non-Federal 
entities  that  administer  Federal  awards.  In  addition,  the  Circular  serves  to  ensure  that 
Federal  departments  and  agencies  rely  on  and  use  the  audit  work  to  the  maximum 
extent  practicable.  To  meet  the  intent  of  the  law  and  the  Circular,  a  complete  reporting 
package  on  each  single  audit  is  submitted  to  the  Single  Audit  Clearinghouse  from  the 
auditee  (non-Federal  entity)  that  includes  the  following: 

•  Data  collection  form  certified  by  the  auditee  that  the  audit  was  completed 
according  to  the  OMB  Circular  A-133; 

•  Financial  statements  and  related  opinion; 

•  Schedule  of  Expenditures  of  Federal  Awards  and  related  opinion; 

•  Report  on  internal  control  and  compliance  review  related  to  the  financial 
statements; 

•  Report  on  internal  control  over  compliance  and  on  compliance  with  laws, 
regulations,  and  the  provisions  of  contracts  or  grant  agreements,  and  related 
opinion  on  compliance  of  major  programs;  and 

•  Schedule  of  Findings  and  Questioned  Costs. 


OMB  issues  an  annual  Compliance  Supplement  that  assists  the  auditors  in  determining 
the  audit  scope  for  the  Circular’s  requirements  for  review  of  internal  control.  For  each 
compliance  requirement,  the  Supplement  describes  the  objectives  of  internal  control  and 
certain  characteristics  that,  when  present  and  operating  effectively,  may  ensure 
compliance  with  program  requirements.  The  Supplement  gives  examples  of  the 
common  characteristics  for  the  five  components  of  internal  control  (control 
environment,  risk  assessment,  control  activities,  information  and  communication,  and 
monitoring)  for  each  compliance  requirement.  The  following  14  compliance 
requirements  applicable  to  the  various  Federal  programs  are  identified  in  the 
Supplement: 


A. 

Activities  Allowed/Unallowed 

B. 

Allowable  Costs/Cost 

Principles 

C. 

Cash  Management 

D. 

Davis-Bacon  Act 

E. 

Eligibility  of  Federal  Funds 

F. 

Equipment  and  Real  Property 

Management 

G. 

Matching,  Level  of  Effort, 

Earmarking 

H .  Period  of  Availability  of  Federal  Funds 

I.  Procurement  and  Suspension  and 

Debarment 

J.  Program  Income 

K.  Real  Property  Acquisition/Relocation 
Assistance 

L.  Reporting 

M.  Subrecipient  Monitoring 

N.  Special  Tests  and  Provisions 
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Appendix  B,  Report  Distribution 


Mr.  Dean  Graves,  Treasurer 
Institute  for  Defense  Analyses 
1801  North  Beauregard  Street 
Alexandria,  VA  22311 

Mr.  Larry  Farmer,  Partner 
PricewaterhouseCoopers  LLP 
1751  Pinnacle  Drive,  Suite  800 
McLean,  VA  22102 

Mr.  Lawrence  Uhlfelder 
Assistant  Director,  Policy  and  Plans 
Defense  Contract  Audit  Agency 
8725  John  J.  Kingman  Road,  Suite  2353 
Fort  Belvoir,  VA  22060-6219 

Director 

Defense  Contract  Management  Agency 
8725  John  J.  Kingman  Road,  Suite  4539 
Fort  Belvoir,  VA  22060-3060 

Director,  Defense  Procurement 
Office  of  the  Under  Secretary  of  Defense 
for  Acquisition,  Technology,  and  Logistics 
3060  Defense  Pentagon 
Washington,  DC  20301-3060 


Director,  Defense  Research  and  Engineering 
Office  of  the  Under  Secretary  of  Defense 
for  Acquisition,  Technology,  and  Logistics 
3030  Defense  Pentagon 
Washington,  DC  20301-3030 

Administrating  Contracting  Officer 
(Kathleen  Jackson) 

DCMA  Baltimore 
ATTN:  GTOG 

217  East  Redwood  Street,  Suite  1800 
Baltimore,  MD  21202-5299 

DCMA  Baltimore 

ATTN:  GTTA  (Site  Monitor) 

217  East  Redwood  Street,  Suite  1800 
Baltimore,  MD  21202-5299 

Procurement  Contracting  Officer 
(Kathy  Dobeck) 

Defense  Supply  Service-Washington 
Room  1D245,  The  Pentagon 
Washington,  DC  20310-5220 

Procurement  Contracting  Officer 
(Timothy  Denhardt) 

Maryland  Procurement  Office 
ATTN:  N13  R&E  Building 
9800  Savage  Road 

Fort  George  G.  Meade,  MD  20755-6000 
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This  page  was  left  out  of  original  document 


PricewaterhouseCoopers,  LLP,  Comments 


PRlCB/VAfmiOUS^PERS  § 


PrlcekvatPrhoMseCoBpcrs  U  ? 
i/51  Pinnacle  Drive 
McUan  VA  22102  IBl  1 
Telephone  (703)  9)0  3000 
Facsimile  (703)  910  3UK> 


Ms  Patricia  A  Brannin 
Deputy  Assistant  Inspector  General 
for  Audit  Policy  and  Oversight 
Office  of  Inspector  General,  DOD 
400  Army  Navy  Drive 
Suite  737 

Arilington,  VA.  22202-2885 
31  July  2000 

Subject:  Comments  on  Draft  Discussion  Draft 
Project  No.  D2000-OA-0123 
Institute  for  Defense  Analyses  (IDA) 

Dear  Ms  Brannin: 


Thank  you  for  the  opportunity  to  respond  to  the  discussion  draft  of  your  quality  control 
review  of  the  PwC  0MB  Circular  A-1 33  audit  of  IDA  for  the  iiscal  year  ended 
September  25,  1998  We  appreciate  the  time  Mr  Berry  and  Ms  Wallis  spent  with  us 
reviewing  this  draft  and  making  suggestions  for  the  development  of  the  action  plan 
discussed  below. 


In  particular,  wc  appreciate  their  providing  to  us  a  copy  of  the  Defense  Contract  Audit 
Agency  (DCAA)  audit  report  No  612M999HI0160001  dated  October  1.  1999  on  its 
Circular  A-133  audit  of  IDA  for  the  year  ended  September  25,  1998.  While  our  client 
had  received  a  draft  of  the  DCAA  audit  report,  we  were  not  aware  of  this  report  As  wc 
have  discussed  with  Mr  Berry  and  Ms  Wallis,  communications  could  be  enhanced 
among  us,  our  client,  and  the  DCAA 


As  suggested  in  your  discussion  draft,  much  of  the  work  the  DCAA  and  wc  performed 
was,  with  hindsight,  duplicative  The  DCAA  performed  an  audit  under  OMB  Circular 
A-133  solely  ats  it  pertains  to  applicable  compliance  requirements  of  federal  awards 
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Ms  PatricliA  BrannJn 
July  31. 2000 
Pag«2 


We  iKJued  a  complete  0MB  Circular  A-133  report  covering  both  the  financial  statements 
and  applicable  compliance  requirements  of  federal  awards  The  duplication  of  effort  with 
respect  to  federal  awards  is  unnecessary  under  the  “co-ordination  of  effort”  concept 
encouraged  by  the  Circular 


Action  Plan 


As  we  discussed  with  Mr.  Berry  and  Ms  Wallis,  wc  propose  to  co-ordinate  our  work 
more  thoroughly  with  DCAA  on  both  a  prospective  and  a  r^tro^eji^  basis  Based  on 
conversations  we  are  currently  having  with  DCAA.  wc  plan  to  withdraw  and  attempt  to 
recover  all  copies  of  our  1998  OMB  Circular  A-l  33  report  on  federal  awards  Under  this 
plan  we  will  revise  the  Single  Audit  reporting  package  required  by  paragraph  320  c  ot 
OMB  Circular  A- 133  to  reflect  the  portions  of  the  OMB  Circular  A-133  audit  performed 
by  our  firm  and  DCAA  This  action  will  also  necessitate  a  re- filing  of  IDA’s  1998  data 
collection  form  with  the  Single  Audit  Clearing  House  I  he  details  of  these  actions  arc 
currently  being  worked  out  with  DCAA 


We  also  plan  to  credit  our  client  with  a  portion  of  the  incremental  audit  fee  for  the  1 998 
A- 1 33  audit  report.  We  estimate  that  credit  will  approximate  $1 7,000 


Going  forward  (including  1 999),  wc  plan  to  continue  this  division  of  audit  effort  to  the 
extent  wc  can  arrive  at  a  mutual  agreement  with  DCAA  Both  organizations  have  agreed 
that  should  it  become  necessary  to  support  one  another  in  our  individual  efforts,  we  will 
do  so 


This  proposed  action  resolves  in  an  effective  and  efficient  way  most  of  the 
recommendations  included  in  your  discussion  draft  for  both  us  and  IDA  As  noted  m  the 
attachment  to  this  letter,  many  of  the  recommendations  will  be  addressed  in  future 
audits  The  IDA  responses  in  the  attachment  have  been  reviewed  with  our  client  who 
concurs  witli  the  responses  Furthermore,  the  preparation  of  this  correspondence  was 
coordinated  with  Mr  Derry  and  Ms  Wallis, 
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OIG  Recommendations  and  Response 


OiG  Recommendalion 

Response 

For  PwC: 

a  Documcnl  in  the  working  papers  judgments, 
procedures,  ai^d  results  or  conclusions  with  relevant 
and  suRlcienl  evidence  for  all  audit  steps 

a  This  recommendation  pertains  to  federal  award 
work  since  the  discussion  draft  did  not  question  our 
audit  of  the  financial  statements  In  tlte  future,  we 
will  ensure  that  the  working  papers  clearly 
document  Judgements,  procedures  and  results  or 
conclusions  with  evidence  of  all  steps  As  it  relates 
to  the  1998  audit  of  I  DA,  the  DC  A  A  audit  report 
covers  all  applicable  compliance  requirements  for 
federal  awards. 

b  Revise  audit  programs  for  single  audit  to  comply 
with  the  requirements  of  0MB  Circular  A-133  to 
include  audit  steps  that  document  an  understanding 
of  the  S  internal  control  elements  related  to  each  of 
the  14  compliance  requirements 

b  With  respect  to  our  practice  overall,  we  have 
taken  and  continue  to  take  steps  to  introduce  new 
eketrortk  audit  program  and  continuing 
professional  education  on  these  manors  The 
revised  audit  program  will  be  tailored  as 
appropriate  for  IDA  to  comply  with  all 
requirements  of  OMB  Circular  A-133  related  to 
internal  control. 

c  Coordinate  and  document  audit  effort  with 

Federal  auditors,  throughout  the  conduct  of  the 
single  audit  according  to  0MB  Circular  A*  133. 

c  The  Action  Plan  discussed  in  our  letter  satisfies 
this  recommendation 

d  Obtain  training  to  ensure  the  staff  assigned  to 
the  OMB  Circular  A<  1 33  audits  is  properly  trained 

d  Wc  have  and  will  continue  to  do  so  in  the  futuie 
Attached  is  documentation  of  the  1998  audit  staff's 
compliance  with  the  CPE  requirements  of  GAGAS 
for  financial  statement  audit  purposes. 

e  Adhere  to  its  audit  program  step  for  the  single 
audit  that  requires  continuing  professional  education 
for  all  audits  assigned  to  the  engagement  be 
documented  in  the  working  papers 

e  In  the  future,  we  will  include  such  documentation 
in  the  working  papers 

For  IDA 

a  Require  that  PwC  redo  the  audit  of  IDA  for  its 
fiscal  year  ended  September  25,  1998  according  to 
OMB  Circular  A-133  and  at  no  additional  cost  to 
the  Federal  Government. 

a  The  Action  Plan  described  in  the  PwC  letter 
achieves  the  desired  result  in  an  effective  and 
cfTicient  manner 

b  Identify  as  unallowable  any  costs  associated  with 
audit  services  that  were  originally  provided  by  PwC 
to  report  on  the  Fiscal  Year  1998  single  audit  until 
the  audit  is  corrected  in  accordance  with  OMB 
Circular  A-133. 

b  The  Action  Plan  described  in  the  PwC  letter 
achieves  the  desired  re.sult  In  an  effective  and 
efficient  manner 

Bnsure  that  deficiencies  identified  in  the  Fiscal  Year 
1998  audit  are  not  repealed  in  the  Fiscal  Year  1999 
and  ftiuire  single  audits. 

c  Ihe  Action  Plan  described  in  the  PwC  letter 
achieves  the  desired  result  in  an  effective  and 
elficient  manner. 
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Evaluation  Team  Members 


This  report  was  prepared  by  the  Deputy  Assistant  Inspector  General  for  Audit  Policy 
and  Oversight,  Office  of  the  Assistant  Inspector  General  for  Auditing,  DoD. 

Wayne  C.  Berry 
M.  Joanne  Wallis 
Ernest  R.  Taylor 
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